@desplega.ai/agent-swarm 1.112.0 → 1.114.0

package/dist/cli-49j095n9.js

@@ -0,0 +1,393 @@
+import {
+  calculatePKCECodeChallenge,
+  generateRandomCodeVerifier,
+  generateRandomState
+} from "./cli-0pygq9r1.js";
+import {
+  getDb,
+  init_date_utils,
+  init_db,
+  normalizeDateRequired
+} from "./cli-jzwtn8rm.js";
+
+// src/be/db-queries/oauth.ts
+init_date_utils();
+init_db();
+function normalizeOAuthApp(row) {
+  return {
+    ...row,
+    createdAt: normalizeDateRequired(row.createdAt),
+    updatedAt: normalizeDateRequired(row.updatedAt)
+  };
+}
+function normalizeOAuthTokens(row) {
+  return {
+    ...row,
+    createdAt: normalizeDateRequired(row.createdAt),
+    updatedAt: normalizeDateRequired(row.updatedAt)
+  };
+}
+function getOAuthApp(provider) {
+  const row = getDb().query("SELECT * FROM oauth_apps WHERE provider = ?").get(provider);
+  return row ? normalizeOAuthApp(row) : null;
+}
+function upsertOAuthApp(provider, data) {
+  const metadataProvided = data.metadata !== undefined;
+  const sql = metadataProvided ? `INSERT INTO oauth_apps (provider, clientId, clientSecret, authorizeUrl, tokenUrl, redirectUri, scopes, metadata)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(provider) DO UPDATE SET
+         clientId = excluded.clientId,
+         clientSecret = excluded.clientSecret,
+         authorizeUrl = excluded.authorizeUrl,
+         tokenUrl = excluded.tokenUrl,
+         redirectUri = excluded.redirectUri,
+         scopes = excluded.scopes,
+         metadata = excluded.metadata,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')` : `INSERT INTO oauth_apps (provider, clientId, clientSecret, authorizeUrl, tokenUrl, redirectUri, scopes, metadata)
+       VALUES (?, ?, ?, ?, ?, ?, ?, '{}')
+       ON CONFLICT(provider) DO UPDATE SET
+         clientId = excluded.clientId,
+         clientSecret = excluded.clientSecret,
+         authorizeUrl = excluded.authorizeUrl,
+         tokenUrl = excluded.tokenUrl,
+         redirectUri = excluded.redirectUri,
+         scopes = excluded.scopes,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
+  if (metadataProvided) {
+    getDb().query(sql).run(provider, data.clientId, data.clientSecret, data.authorizeUrl, data.tokenUrl, data.redirectUri, data.scopes, data.metadata);
+  } else {
+    getDb().query(sql).run(provider, data.clientId, data.clientSecret, data.authorizeUrl, data.tokenUrl, data.redirectUri, data.scopes);
+  }
+}
+function getOAuthTokens(provider) {
+  const row = getDb().query("SELECT * FROM oauth_tokens WHERE provider = ?").get(provider);
+  return row ? normalizeOAuthTokens(row) : null;
+}
+function storeOAuthTokens(provider, data) {
+  getDb().query(`INSERT INTO oauth_tokens (provider, accessToken, refreshToken, expiresAt, scope)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(provider) DO UPDATE SET
+         accessToken = excluded.accessToken,
+         refreshToken = COALESCE(excluded.refreshToken, oauth_tokens.refreshToken),
+         expiresAt = excluded.expiresAt,
+         scope = COALESCE(excluded.scope, oauth_tokens.scope),
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`).run(provider, data.accessToken, data.refreshToken ?? null, data.expiresAt, data.scope ?? null);
+}
+function updateOAuthTokensAfterRefresh(provider, expectedRefreshToken, data) {
+  const result = getDb().query(`UPDATE oauth_tokens
+       SET accessToken = ?,
+           refreshToken = ?,
+           expiresAt = ?,
+           scope = COALESCE(?, scope),
+           updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+       WHERE provider = ? AND refreshToken = ?`).run(data.accessToken, data.refreshToken, data.expiresAt, data.scope ?? null, provider, expectedRefreshToken);
+  if (result.changes === 1)
+    return;
+  const current = getOAuthTokens(provider);
+  if (!current) {
+    throw new Error(`OAuth token refresh persistence failed for ${provider}: token row missing`);
+  }
+  if (current.refreshToken !== expectedRefreshToken) {
+    throw new Error(`OAuth token refresh persistence failed for ${provider}: stored refresh token changed during refresh`);
+  }
+  throw new Error(`OAuth token refresh persistence failed for ${provider}: no rows updated`);
+}
+function listOAuthTokenSweepRows() {
+  const rows = getDb().query(`SELECT t.provider,
+              CASE WHEN a.provider IS NOT NULL THEN 1 ELSE 0 END AS hasApp,
+              CASE WHEN t.refreshToken IS NOT NULL AND t.refreshToken != '' THEN 1 ELSE 0 END AS hasRefreshToken,
+              t.expiresAt,
+              t.updatedAt
+       FROM oauth_tokens t
+       LEFT JOIN oauth_apps a ON a.provider = t.provider
+       ORDER BY t.provider ASC`).all();
+  return rows.map((row) => ({
+    provider: row.provider,
+    hasApp: row.hasApp === 1,
+    hasRefreshToken: row.hasRefreshToken === 1,
+    expiresAt: normalizeDateRequired(row.expiresAt),
+    updatedAt: normalizeDateRequired(row.updatedAt)
+  }));
+}
+function deleteOAuthTokens(provider) {
+  getDb().query("DELETE FROM oauth_tokens WHERE provider = ?").run(provider);
+}
+function isTokenExpiringSoon(provider, bufferMs = 5 * 60 * 1000) {
+  const tokens = getOAuthTokens(provider);
+  if (!tokens)
+    return true;
+  const expiresAt = new Date(tokens.expiresAt).getTime();
+  return expiresAt - Date.now() < bufferMs;
+}
+function acquireOAuthRefreshLock(provider, ttlMs) {
+  const owner = crypto.randomUUID();
+  const now = Date.now();
+  const expiresAt = new Date(now + ttlMs).toISOString();
+  const nowIso = new Date(now).toISOString();
+  getDb().query(`INSERT INTO oauth_refresh_locks (provider, owner, expiresAt, createdAt, updatedAt)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(provider) DO UPDATE SET
+         owner = excluded.owner,
+         expiresAt = excluded.expiresAt,
+         updatedAt = excluded.updatedAt
+       WHERE oauth_refresh_locks.expiresAt <= ?`).run(provider, owner, expiresAt, nowIso, nowIso, nowIso);
+  const row = getDb().query("SELECT owner FROM oauth_refresh_locks WHERE provider = ?").get(provider);
+  return row?.owner === owner ? owner : null;
+}
+function releaseOAuthRefreshLock(provider, owner) {
+  getDb().query("DELETE FROM oauth_refresh_locks WHERE provider = ? AND owner = ?").run(provider, owner);
+}
+
+// src/oauth/wrapper.ts
+var STATE_TTL_MS = 10 * 60 * 1000;
+var pendingStates = new Map;
+function cleanupExpiredStates() {
+  const now = Date.now();
+  for (const [key, entry] of pendingStates) {
+    if (now - entry.createdAt > STATE_TTL_MS) {
+      pendingStates.delete(key);
+    }
+  }
+}
+async function buildAuthorizationUrl(config) {
+  cleanupExpiredStates();
+  const state = generateRandomState();
+  const codeVerifier = generateRandomCodeVerifier();
+  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
+  pendingStates.set(state, {
+    codeVerifier,
+    config,
+    createdAt: Date.now()
+  });
+  const url = new URL(config.authorizeUrl);
+  url.searchParams.set("client_id", config.clientId);
+  url.searchParams.set("redirect_uri", config.redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", config.scopes.join(config.scopeSeparator ?? ","));
+  url.searchParams.set("state", state);
+  url.searchParams.set("code_challenge", codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  if (config.extraParams) {
+    for (const [key, value] of Object.entries(config.extraParams)) {
+      url.searchParams.set(key, value);
+    }
+  }
+  return { url: url.toString(), state, codeVerifier };
+}
+function tokenRequestInit(config, params) {
+  const useBasic = config.tokenAuthStyle === "basic";
+  const bodyParams = useBasic ? params : { ...params, client_id: config.clientId, client_secret: config.clientSecret };
+  const headers = {};
+  if (useBasic) {
+    headers.Authorization = `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`;
+  }
+  if (config.tokenBodyFormat === "json") {
+    headers["Content-Type"] = "application/json";
+    return { headers, body: JSON.stringify(bodyParams) };
+  }
+  headers["Content-Type"] = "application/x-www-form-urlencoded";
+  return { headers, body: new URLSearchParams(bodyParams).toString() };
+}
+async function exchangeCode(config, code, state) {
+  const pending = pendingStates.get(state);
+  if (!pending) {
+    throw new Error("Invalid or expired OAuth state");
+  }
+  pendingStates.delete(state);
+  const { codeVerifier } = pending;
+  const response = await fetch(config.tokenUrl, {
+    method: "POST",
+    ...tokenRequestInit(config, {
+      grant_type: "authorization_code",
+      redirect_uri: config.redirectUri,
+      code,
+      code_verifier: codeVerifier
+    })
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Token exchange failed (${response.status}): ${errorText}`);
+  }
+  const data = await response.json();
+  const expiresAt = data.expires_in ? new Date(Date.now() + data.expires_in * 1000).toISOString() : new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+  storeOAuthTokens(config.provider, {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token ?? null,
+    expiresAt,
+    scope: data.scope ?? null
+  });
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in,
+    scope: data.scope
+  };
+}
+async function refreshAccessToken(config, refreshToken) {
+  const response = await fetch(config.tokenUrl, {
+    method: "POST",
+    ...tokenRequestInit(config, {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    })
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Token refresh failed (${response.status}): ${errorText}`);
+  }
+  const data = await response.json();
+  if (typeof data.access_token !== "string" || data.access_token.length === 0) {
+    throw new Error(`Token refresh failed: ${config.provider} response missing access_token`);
+  }
+  if (config.requiresRefreshTokenRotation && (typeof data.refresh_token !== "string" || data.refresh_token.length === 0)) {
+    throw new Error(`Token refresh failed: ${config.provider} response did not include a rotated refresh_token`);
+  }
+  const expiresAt = data.expires_in ? new Date(Date.now() + data.expires_in * 1000).toISOString() : new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+  const nextRefreshToken = data.refresh_token ?? refreshToken;
+  try {
+    updateOAuthTokensAfterRefresh(config.provider, refreshToken, {
+      accessToken: data.access_token,
+      refreshToken: nextRefreshToken,
+      expiresAt,
+      scope: data.scope ?? null
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.warn(`[OAuth] Refusing to use refreshed ${config.provider} access token because persistence failed: ${message}`);
+    throw err;
+  }
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in,
+    scope: data.scope
+  };
+}
+
+// src/oauth/ensure-token.ts
+function parseMetadata(metadataJson) {
+  try {
+    const parsed = JSON.parse(metadataJson || "{}");
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, String(item)]));
+}
+function oauthAppRowToProviderConfig(app) {
+  const metadata = parseMetadata(app.metadata);
+  const extraParams = stringRecord(metadata.extraParams) ?? (typeof metadata.actor === "string" ? { actor: metadata.actor } : undefined);
+  return {
+    provider: app.provider,
+    clientId: app.clientId,
+    clientSecret: app.clientSecret,
+    authorizeUrl: app.authorizeUrl,
+    tokenUrl: app.tokenUrl,
+    redirectUri: app.redirectUri,
+    scopes: app.scopes.split(",").map((scope) => scope.trim()).filter(Boolean),
+    extraParams,
+    scopeSeparator: " ",
+    ...metadata.tokenAuthStyle === "basic" ? { tokenAuthStyle: "basic" } : {},
+    ...metadata.tokenBodyFormat === "json" ? { tokenBodyFormat: "json" } : {},
+    requiresRefreshTokenRotation: app.provider === "jira"
+  };
+}
+var refreshLocks = new Map;
+var REFRESH_LOCK_TTL_MS = 2 * 60 * 1000;
+var REFRESH_LOCK_WAIT_MS = 30 * 1000;
+var REFRESH_LOCK_POLL_MS = 250;
+function getOAuthConfig(provider) {
+  const app = getOAuthApp(provider);
+  return app ? oauthAppRowToProviderConfig(app) : null;
+}
+async function withProviderRefreshLock(provider, fn) {
+  const previous = refreshLocks.get(provider) ?? Promise.resolve();
+  let release;
+  const current = new Promise((resolve) => {
+    release = resolve;
+  });
+  const next = previous.catch(() => {
+    return;
+  }).then(() => current);
+  refreshLocks.set(provider, next);
+  await previous.catch(() => {
+    return;
+  });
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (refreshLocks.get(provider) === next) {
+      refreshLocks.delete(provider);
+    }
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function tokenRowChanged(current, observed) {
+  if (!observed)
+    return current !== null;
+  if (!current)
+    return true;
+  return current.accessToken !== observed.accessToken || current.refreshToken !== observed.refreshToken || current.expiresAt !== observed.expiresAt;
+}
+async function ensureToken(provider, bufferMs) {
+  try {
+    await ensureTokenOrThrow(provider, bufferMs);
+  } catch (err) {
+    console.error(`[OAuth] Failed to refresh ${provider} token:`, err instanceof Error ? err.message : err);
+  }
+}
+var FORCE_REFRESH_BUFFER_MS = 1000 * 60 * 60 * 24 * 365 * 100;
+async function forceRefreshTokenOrThrow(provider) {
+  await ensureTokenOrThrow(provider, FORCE_REFRESH_BUFFER_MS);
+}
+async function ensureTokenOrThrow(provider, bufferMs) {
+  if (!isTokenExpiringSoon(provider, bufferMs))
+    return;
+  const observedTokens = getOAuthTokens(provider);
+  await withProviderRefreshLock(provider, async () => {
+    const waitStartedAt = Date.now();
+    while (isTokenExpiringSoon(provider, bufferMs)) {
+      const tokens = getOAuthTokens(provider);
+      if (tokenRowChanged(tokens, observedTokens))
+        return;
+      const config = getOAuthConfig(provider);
+      if (!config || !tokens?.refreshToken) {
+        console.warn(`[OAuth] ${provider} token expiring but cannot refresh (missing config or refresh token)`);
+        return;
+      }
+      const lockOwner = acquireOAuthRefreshLock(provider, REFRESH_LOCK_TTL_MS);
+      if (!lockOwner) {
+        if (Date.now() - waitStartedAt > REFRESH_LOCK_WAIT_MS) {
+          throw new Error(`Timed out waiting for ${provider} OAuth token refresh lock`);
+        }
+        await sleep(REFRESH_LOCK_POLL_MS);
+        continue;
+      }
+      try {
+        const lockedTokens = getOAuthTokens(provider);
+        if (!isTokenExpiringSoon(provider, bufferMs) || tokenRowChanged(lockedTokens, observedTokens)) {
+          return;
+        }
+        const lockedConfig = getOAuthConfig(provider);
+        if (!lockedConfig || !lockedTokens?.refreshToken) {
+          console.warn(`[OAuth] ${provider} token expiring but cannot refresh (missing config or refresh token)`);
+          return;
+        }
+        await refreshAccessToken(lockedConfig, lockedTokens.refreshToken);
+        console.log(`[OAuth] ${provider} token refreshed successfully`);
+        return;
+      } finally {
+        releaseOAuthRefreshLock(provider, lockOwner);
+      }
+    }
+  });
+}
+
+export { getOAuthApp, upsertOAuthApp, getOAuthTokens, listOAuthTokenSweepRows, deleteOAuthTokens, isTokenExpiringSoon, acquireOAuthRefreshLock, releaseOAuthRefreshLock, buildAuthorizationUrl, exchangeCode, oauthAppRowToProviderConfig, ensureToken, forceRefreshTokenOrThrow, ensureTokenOrThrow };

package/dist/{cli-h9jx5mag.js → cli-5afkmcfj.js}

@@ -1,18 +1,21 @@
 import {
   createAdditiveBuffer,
   extractSlackMessageText
-} from "./cli-76d1vtvq.js";
+} from "./cli-5ktc9fd4.js";
 import {
   getSlackApp,
   registerTreeMessage
-} from "./cli-hm27prrc.js";
+} from "./cli-hq39e630.js";
+import {
+  rewriteSlackMentions
+} from "./cli-w4wk3kx6.js";
 import {
   buildBufferFlushBlocks
 } from "./cli-6xd0bvf8.js";
 import {
   createTaskWithSiblingAwareness,
   slackContextKey
-} from "./cli-0c3n0eba.js";
+} from "./cli-312v3c41.js";
 import {
   getLatestActiveTaskInThread,
   getLeadAgent,
@@ -20,7 +23,7 @@ import {
   init_db,
   init_registry,
   registerTemplate
-} from "./cli-951w7c79.js";
+} from "./cli-jzwtn8rm.js";
 
 // src/slack/event-dedup.ts
 var DEFAULT_TTL_MS = 300000;
@@ -164,7 +167,7 @@ async function getThreadContextForBuffer(channelId, threadTs) {
       return `<@${m.user}>: ${text}`;
     }).join(`
 `);
-    return formatted;
+    return rewriteSlackMentions(formatted);
   } catch (error) {
     console.error("[Slack] Failed to fetch thread context for buffer:", error);
     return "";
@@ -181,9 +184,9 @@ async function slackFlush(items, key, immediate) {
   const { channelId, threadTs } = split;
   const originalRequesterId = items[0].userId;
   console.log(`[Slack] Flushing buffer: ${key} (${items.length} messages, immediate=${immediate})`);
-  const combinedText = items.map((m) => m.text).join(`
+  const combinedText = rewriteSlackMentions(items.map((m) => m.text).join(`
 ---
-`);
+`));
   const description = `[Thread follow-up — ${items.length} message(s) buffered]
 
 ${combinedText}`;

package/dist/{cli-76d1vtvq.js → cli-5ktc9fd4.js}

@@ -3,7 +3,7 @@ import {
   getAgentWorkingOnThread,
   getAllAgents,
   init_db
-} from "./cli-951w7c79.js";
+} from "./cli-jzwtn8rm.js";
 
 // src/slack/router.ts
 init_db();